So Daniel sent us this one — he's been thinking about the Zim conversation, how Israel once had the foresight to build a shipping company from scratch to avoid foreign dependence, and yet today we're watching Chinese state-owned enterprises win tenders on ports, rail, and other critical infrastructure. His question is essentially: how did a country with Ben-Gurion's non-dependence doctrine baked into its DNA end up handing the keys to its ports to a foreign state-owned operator? And the elephant in the room — is the Trojan horse fear, the embedded malware scenario, actually what we should be worried about, or is there something bigger going on?
The Trojan horse framing is what grabs headlines, but it's also the thing that lets governments off the hook. If the risk is just a piece of malware someone might sneak into a terminal operating system, you can audit for that. You can hire a cyber firm, scan the stack, declare it clean. The real problem is that by the time the twenty-five-year concession ends, you've forgotten how to run your own port.
That's the structural dependency you keep pointing to.
And it's the part nobody wants to talk about because it's slow, boring, and doesn't make for a good threat briefing. But let's back up and frame this properly. Every government awarding an infrastructure tender is staring at a trilemma. Three objectives: cost efficiency, speed of delivery, and national security. You can optimize for any two, but not all three simultaneously. If you want it cheap and fast, you're compromising on security. If you want it secure and fast, it won't be cheap. And if you want it cheap and secure —
You'll be waiting a very long time.
Right. And that trilemma is the engine behind everything we're about to discuss. Think of it like a triangle where you can only stand on two vertices at once. The third one is always out of reach.
So let's define what we mean by critical infrastructure here, because the term gets thrown around loosely. I've seen it applied to everything from a nuclear reactor to a municipal parking garage.
For this conversation: ports, power grids, undersea cables, 5G networks, and water systems. These are assets where a compromised component — software or hardware — can give a foreign state persistent access, or the ability to deny service at a strategically chosen moment. The key word is persistent. These aren't smash-and-grab cyberattacks. These are concessions measured in decades. A parking garage doesn't make the cut. But a water treatment plant absolutely does — and that's one most people never think about.
Because you can't hold a city hostage with a parking garage.
You cannot. Although I'm sure someone's tried.
And the thesis you're building toward?
The Trojan horse fear is real but overhyped for ports specifically. The more subtle and dangerous risk is structural dependency. Once a Chinese firm operates your port for twenty-five years, your country loses the institutional knowledge to run it independently. Your port authority doesn't train the next generation of engineers on the terminal operating system — the Chinese operator does, using their proprietary stack, their documentation, their workflows. When the concession ends, you don't get your port back in any meaningful sense. You get a piece of coastal real estate with a bunch of systems you no longer understand.
So the dependency becomes self-renewing.
And that's not a bug in the model — it's the feature that makes the low bid possible. The operator knows that in year twenty-four, the host government will have exactly two choices: extend the concession or watch its port grind to a halt. That's not a commercial negotiation at that point. That's a hostage situation conducted entirely through contracts.
And that's the part that doesn't show up in the cost-benefit analysis at the time of the tender.
Because it's not quantifiable in year one. You can't put a line item in a spreadsheet for "loss of sovereign capability in two decades." Spreadsheets don't have a column for that.
Alright, let's get concrete. Walk me through Haifa.
In twenty twenty-one, Shanghai International Port Group — SIPG — won a twenty-five-year concession to operate the new Haifa Bay port terminal. They beat local and European bidders on price. The US State Department formally objected, and the objection wasn't subtle. The Israeli navy has a base adjacent to that port. The Americans were concerned about SIPG having visibility into naval vessel movements, logistics patterns, and the broader shipping intelligence picture.
And what does that visibility actually look like in practice? If I'm sitting in a SIPG control room, what am I seeing?
You're seeing every vessel that enters or leaves the port complex — civilian and military. You're seeing the timing, the frequency, the draft of the ship which tells you how heavily it's loaded. You're seeing which supply vessels are provisioning which naval ships. Over time, you build a pattern-of-life picture that tells you when the navy is preparing for an exercise, or when a submarine tender shows up unexpectedly. None of that requires a spy satellite. It just requires the terminal operating system and a patient analyst.
So you don't need to bug the naval base. You just need to operate the port next door.
That's the asymmetry. The naval base can have perfect physical security and it doesn't matter, because the intelligence is leaking through the commercial logistics data.
And Israel's response?
The tender was structured around operational efficiency and cost. Security considerations were raised but didn't fundamentally alter the procurement framework. SIPG made the best commercial offer, and the commercial logic carried the day.
Which is exactly how the trilemma plays out in practice. You optimize for cost, and security becomes an afterthought.
And to be fair to the decision-makers, it's not that they were oblivious. It's that the procurement process itself isn't wired to weigh a twenty-year intelligence risk against a fifteen-percent cost saving. The cost saving is concrete and immediate. The intelligence risk is probabilistic and downstream.
Now let's talk about the technical vector, because this is where the Trojan horse discussion actually matters. A modern port runs on something called a Terminal Operating System — a TOS. This is the software that controls crane movements, container tracking, customs data integration, and ship scheduling. Everything that moves through that port is logged, routed, and managed by the TOS.
And I want to pause on this because most people picture a port as guys with hard hats and clipboards. That's not what a modern port is. A modern port is a real-time data operation that happens to have cranes attached to it. The TOS is the brain. The cranes are the hands. If you own the brain, you don't need to touch the hands.
And the operator has root access.
The operator is the root. They're not a tenant on someone else's platform — they deploy and manage the system. With that level of access, a foreign operator can exfiltrate shipping manifests in real time, manipulate cargo routing to create bottlenecks, or introduce latency into operations that looks like normal technical friction but is actually deliberate. Imagine a scenario where a particular shipment needs to be delayed by exactly forty-eight hours for geopolitical reasons. You don't need to stop the crane. You just need the TOS to deprioritize that container in the scheduling algorithm. It sits in the yard for two extra days, and everyone blames congestion.
And no one's going to audit the scheduling algorithm for bias.
They wouldn't even know where to start. The algorithm is proprietary. The operator says it's optimized for efficiency, and maybe it is — most of the time.
And the golden share mechanism that protected Zim — why doesn't that model translate?
This is the misconception that drives me up the wall. A golden share gives the government veto power over strategic corporate decisions — mergers, acquisitions, board appointments, asset sales. It works for corporate governance. But an infrastructure concession is not a corporate governance problem. The operator has physical control of the asset twenty-four seven. You can't veto a backdoor that was already installed during year two of a twenty-five-year contract. You can't veto the training program that taught your local workforce to depend on proprietary Chinese software. The golden share is a boardroom tool, and the threat here is operational.
So the tool that worked for Zim is categorically wrong for ports.
Completely. And that confusion — treating all strategic assets as if they're the same kind of thing — is part of why we're in this situation. It's like using a seatbelt to secure a bank vault. It's the right category of intention, but the wrong tool for the threat model.
Let's look at Greece, because Piraeus is the case everyone cites.
COSCO, which is China's state-owned shipping giant, acquired a sixty-seven percent stake in the Piraeus Port Authority in twenty sixteen. They invested heavily, modernized the facilities, and turned it into Europe's fourth-largest container port. By commercial metrics, it's a success story. Greece got investment, traffic, jobs. The port went from a regional afterthought to a major Mediterranean hub.
But?
EU audits later flagged that COSCO retained exclusive control over security zones and surveillance systems. The Greek state had limited visibility into what was happening inside its own port. And here's the structural dependency in action: COSCO didn't just operate the port — they became the port. The institutional knowledge, the operational playbooks, the software stack — all COSCO's. If Greece wanted to take it back tomorrow, they couldn't. They'd have to rebuild the operational capability from scratch, which would take years and cost billions.
And during those years, the port's throughput would collapse.
Which no Greek government is going to volunteer for. So the concession continues. Not because anyone decided it should, but because no one can afford the alternative.
Which brings us to the Five Eyes comparison.
The US, UK, Canada, Australia, and New Zealand have built formalized infrastructure screening processes. In the US it's CFIUS — the Committee on Foreign Investment in the United States. In the UK it's the National Security and Investment Act. These are centralized bodies that review foreign acquisitions and concessions through a national security lens before they happen. They have the authority to block deals, impose conditions, or require divestment.
And they're staffed by people who think about exactly the scenario you just described — the slow, boring dependency play, not just the malware scenario.
Right. CFIUS isn't just looking for backdoors in code. They're looking at the whole picture: who controls the training pipeline, who owns the intellectual property, what happens in year fifteen if relations with that country deteriorate. They're scenario-planning a decade out.
And Israel?
Israel doesn't have a comparable centralized body. Tenders are evaluated by individual ministries — the Transport Ministry for ports, the Energy Ministry for power infrastructure, the Communications Ministry for 5G. Each ministry optimizes for its own mandate. The Transport Ministry cares about throughput and cost per container. It's not their job to worry about naval intelligence.
So the security review falls through the cracks between ministries.
It's a structural gap, and it's not unique to Israel. But for a country of Israel's size and threat profile, the gap is especially glaring. A larger country can absorb some strategic leakage. Israel's margin for error is much narrower.
Alright, so the immediate technical risk is real — TOS compromise, data exfiltration, operational manipulation. But you said earlier that's only half the story. What's the other half?
The lock-in. Let's talk about what happens a decade into a concession. The Chinese operator has been running the port for ten years. They've trained the local workforce on their systems. The port authority's own engineering team has atrophied — the people who understood the legacy systems retired or moved on, and the new hires learned on the Chinese stack. The software is proprietary, the documentation is in Mandarin, and the operational playbooks are sitting on servers in Shanghai.
So even if the concession ends, you're not getting the port back.
You're getting a building and some cranes. The knowledge of how to run it efficiently is gone. And at that point, what does the government do? It extends the concession, because the alternative is a port that doesn't work. And the operator knows this. They're not worried about the concession ending. They're worried about it not being renewed on even better terms.
The concession becomes a de facto permanent transfer of sovereignty.
And this is not theoretical. Look at Sri Lanka.
Hambantota.
In twenty seventeen, Sri Lanka leased Hambantota Port to China for ninety-nine years. The backstory: Sri Lanka borrowed heavily from China to build the port in the first place, couldn't repay the loans, and China Merchant Port Holdings now operates it. The port is widely assessed to be a strategic naval asset for the PLA Navy in the Indian Ocean. Sri Lanka didn't lose the port to a malware attack. They lost it to debt.
The debt-trap diplomacy model.
Which is distinct from the competitive tender model we saw in Haifa, but it achieves the same outcome. China's Belt and Road Initiative offers low-interest loans for infrastructure projects that host countries can't realistically repay. When the default comes, the asset is transferred at a discount. It's not a conspiracy theory — it's a documented pattern. Hambantota is the textbook case. The port was built with Chinese loans, the loans became unserviceable, and now China operates a deep-water port in the middle of the Indian Ocean.
And the difference with Israel is that Israel isn't taking BRI loans for ports. It's awarding competitive tenders.
Right. Israel's vulnerability isn't debt — it's the trilemma. The price difference between a Chinese state-owned bid and a European or local bid can be enormous. SIPG can bid low because it's not optimizing for profit on that single concession. It's optimizing for strategic position. The Chinese state is underwriting the bid in ways that a private European operator can't match. A European consortium has to show a return to shareholders. SIPG has to show strategic value to Beijing. Those are different spreadsheets.
So the "competitive" in competitive tender is a bit of a fiction when one bidder is backed by a state with strategic objectives.
It's a market distortion dressed up as a market outcome. And it's not even subtle. The Chinese state owns the bank that finances the bid, the insurance company that underwrites it, and the construction firm that builds it. That's not a competitor. That's a vertically integrated strategic apparatus wearing a commercial hat.
Let's shift to the domestic construction angle, because Daniel mentioned Chinese companies deploying workforces to build projects inside Israel.
China State Construction Engineering Corporation — CSCEC — built the Tel Aviv Red Line light rail, which became operational in twenty twenty-three. Now, construction-only contracts are lower risk than operational concessions. CSCEC isn't running the light rail — they built it and handed it over. The risk vector there is different: workforce dependency. What happens if China recalls its workers during a crisis?
Or if the workers are, knowingly or not, gathering intelligence?
That's harder to quantify, but it's not nothing. A construction workforce embedded in a city for years has access to utility layouts, traffic patterns, soil composition data — things that have dual-use applications. I'm not saying every CSCEC engineer is an intelligence officer. But the infrastructure is there, the access is there, and the reporting structure ultimately goes back to a state-owned entity. The point is that the construction market and the operations market are connected. Once Chinese firms establish a foothold in domestic construction, they build relationships, they understand the regulatory environment, and they're better positioned to bid on the higher-stakes operational concessions.
So the construction presence is a beachhead.
And the US has been trying to counter this with its own infrastructure initiative. In twenty twenty-three, the US launched the Partnership for Global Infrastructure and Investment — PGII — pledging six hundred billion dollars for infrastructure in developing countries. The idea is to offer an alternative to BRI.
How's that going?
Mixed. PGII is structured as grants and private investment, not direct loans. That makes it slower to deploy and less attractive to cash-strapped governments that want a single check, not a consortium of investors with conditions. China can write a loan agreement in weeks. PGII takes months or years to assemble a deal. Speed matters in the trilemma.
So the US is offering the secure-but-slow corner of the triangle, and a lot of governments are choosing fast and cheap instead.
And they're not wrong to do so, from a short-term political perspective. If you're a finance minister and your port is crumbling, and SIPG offers to fix it tomorrow at half the cost of the European bid, and the security risk is abstract and five years away — you take the deal. The incentives are misaligned. The minister gets the ribbon-cutting. The security consequences land on their successor.
This is the classic principal-agent problem in government. The person who signs the deal is not the person who deals with the consequences.
And the ribbon-cutting photo is very real. The degraded naval intelligence picture fifteen years later is very abstract. Politicians optimize for the photo.
This is where I want to push on the Trojan horse framing directly. You said it's overhyped for ports. Why?
Because physical infrastructure is harder to weaponize covertly than most people assume. If you want to use a port for espionage, you need to exfiltrate data — shipping manifests, naval schedules, customs records. That's valuable intelligence, but it's not the same as being able to shut down a country's power grid remotely. A port is a data-rich environment, but it's not a remote-control environment in the same way a software-defined network is.
Whereas with smart grids and 5G —
Completely different threat profile. A software-defined network in a 5G stack or a smart grid allows remote, undetectable access. You can be in Beijing and manipulate load balancing on a power grid in Tel Aviv. You can introduce packet-routing anomalies in a 5G network that siphon data without anyone noticing for years. The port case is a proxy for a much larger problem. The real Trojan horse isn't in the cranes — it's in the base stations and the grid controllers.
So the port debate is almost a distraction from where the real vulnerability lies.
It's the visible, tangible thing that politicians can argue about. You can take a photo of a port. You can stand in front of a crane. Undersea cables and 5G core networks are invisible to most voters. But HMN Tech — formerly Huawei Marine — has built or is building more than thirty undersea cable systems globally. That's the infrastructure that carries the internet between continents. If you control the cable landing station, you control the data.
And you can't exactly hold a press conference in front of a fiber-optic cable on the ocean floor.
Terrible optics. Very wet.
And the same trilemma applies — cost, speed, security.
With higher stakes, because data flows are harder to monitor than shipping containers. You can put a customs inspector on a dock. You can't put one on a fiber-optic cable. The volume of data moving through a cable landing station makes a port's shipping manifests look like a Post-it note.
Alright, so we've mapped the problem. Technical compromise risk, structural dependency, debt-trap diplomacy, the trilemma, the institutional gaps. What do governments actually do about this?
Three concrete ideas. First, a critical infrastructure triage framework. Classify every asset by three dimensions: physical access — can a foreign operator touch the hardware? Software control — do they run the TOS or the SCADA system? And data sensitivity — do they see customs data, military logistics, citizen information? Ports score high on all three. A light rail construction contract scores high on physical access but low on software control and data sensitivity. You triage your screening resources accordingly.
So you don't treat every tender as equally sensitive, but you have a systematic way of knowing which ones are.
Right now, most governments treat a port tender and a road-paving contract as the same category of thing — infrastructure. They're not. One of them gives a foreign operator persistent access to military logistics data. The other gives you asphalt. The triage framework forces you to acknowledge that difference before the tender goes out, not after.
Second idea?
Technology escrow. The golden share model fails for operational control, so replace it with something that actually addresses the problem. Require the foreign operator to deposit the source code and operational playbooks with a neutral third party — say, a Swiss escrow firm or an agreed international body. If the operator is compromised, or if the geopolitical situation shifts, the host country can take over within forty-eight hours. The knowledge isn't lost because it was never exclusively theirs.
That's clever. It doesn't prevent the initial dependency, but it makes it reversible.
And it changes the operator's calculus. If they know the escrow exists, the lock-in strategy doesn't work. They can't use institutional knowledge as leverage because the host country has a copy of the keys. It's the difference between renting an apartment where the landlord keeps the only set of keys, versus one where a copy is held by a lawyer you both trust.
And practically speaking, does the escrow get updated? Because software changes.
Quarterly deposits. Every update, every patch, every configuration change gets mirrored to the escrow. If they miss a deposit, that's a material breach of the concession. You build teeth into the contract from day one.
Third?
Security-by-design clauses in every infrastructure RFP. Require that the TOS or SCADA system be built on open standards with auditable access logs. No proprietary black boxes. Every access event — who touched what, when, from which IP address — is logged and reviewable by the host country's security agency. This doesn't eliminate the risk of exploitation, but it raises the cost dramatically. State-sponsored actors rely on the cover of proprietary systems. If everything is auditable, they have to work much harder to hide.
And the broader lesson from all of this?
The Zim story showed that state creation of strategic assets is possible. But it's rare. Most countries are not going to build their own shipping companies from scratch. The realistic path is not to replicate Ben-Gurion's model wholesale, but to structure concessions so that dependency is reversible. The escrow, the audit clauses, the triage framework — these are the tools that let you accept a foreign operator's bid without accepting permanent loss of control.
So the question isn't "should we let foreign operators bid." The question is "what are the terms that make the dependency temporary."
Right. And right now, most governments aren't asking that second question. They're asking "who's the cheapest" and then scrambling to bolt on security reviews after the contract is signed. By then, the leverage is gone. The operator has already been selected, the price has been locked in, and any security condition you try to add looks like you're moving the goalposts.
Which brings us to the open question that I think keeps infrastructure planners up at night. If Israel — a country that literally built a shipping company from scratch to avoid foreign dependence — can't resist the low-price bid on a port concession, what hope do smaller nations with less institutional capacity have?
Very little, unless the framework changes. And the next frontier isn't ports. It's undersea cables and satellite ground stations. The same trilemma applies, but the monitoring is harder, the data flows are bigger, and the consequences of compromise are more severe. A port moves containers. A cable landing station moves the internet. If you think losing control of a port is bad, wait until a foreign operator controls the physical infrastructure that carries your country's entire data economy.
So the next time you see a headline about a "competitive bid" for a port or a 5G contract, the question to ask isn't "is this a good deal for taxpayers." It's "who gets to touch the software."
And for how long.
And now: Hilbert's daily fun fact.
Hilbert: In Edo period Japan, sumptuary laws strictly regulated what different social classes could wear — but one law specifically banned commoners from dressing their pet monkeys in elaborate silk robes, a practice that had become fashionable among wealthy merchants trying to flaunt status through their animals.
So the monkeys were the loophole.
The monkeys were always the loophole, Herman. Thanks, Hilbert.
This has been My Weird Prompts. Thanks to our producer Hilbert Flumingtop. If you want to send us your own prompt, email the show at show at my weird prompts dot com.
We'll be back soon.
